Using BlueCat DNS with lots of SAN takes long time

[jimbju]

Hi,

When using the BlueCat DNS provider for issuing a cert with lots of SAN (> 50 in my test) it takes a very long time for lego to finish. I think this is because lego does the operations "create TXT record and deploy" for each name. Instead it should first create all 50 TXT records, then it should deploy (only 1 deploy). Thanks for listening! :)

Best regards,
Jim

[ldez]

Hi,

lego operates by domain and not on a group of domains, so it's not possible to deploy after N records.

[jimbju]

Unfortunately I'm not an expert on BlueCat so I'm acting as the man in the middle here. However, my "BlueCat guy" says this:

so I think you can get a way with 1 deployment per zone. If you have all of your txt records under same zone, 1 deployment should be enough

[mindsur]

Hi, to add to this conversation, here is some documentation for V1 bluecat API:
https://docs.bluecatnetworks.com/r/Address-Manager-API-Guide/POST/v1/quickDeploy/9.3.0

Which says this:

Instantly deploys changes the user has made to DNS resource records since the last full or quick deployment. The method asks for the object ID of a DNS zone or network where changes have occurred, in order to determine the associated DNS server for deployment. **Though the method asks for the ID of a single zone or network, if the user has made changes in other zones or networks configured with the same primary server, those changes will also be deployed to the server.**

So it must be possible to batch multiple TXT records into single quick deployment. It's probably safer bet to do deployment per common zone even though it might not be necessary if multiple zones are managed by same DNS server.

[ldez]

#2510 (comment)

[mindsur]

Additionally, if we were to use Bluecat V2 API, there is an option to perform "selective deployment" (/api/docs/#/Server Resources/postDeployment), which sounds like it's even more suited for this use case.
bluecat.openapi.json

I have not tried it myself yet, but example shows that deployment can be triggered providing the newly created resource IDs (in this case TXT records):

example:
POST [/api/v2/deployments]
{ "type": "SelectiveDeployment", "resources": [ { "id": 1234, "type": "HostRecord" }, { "id": 2345, "type": "AliasRecord" }, { "id": 3456, "type": "HostRecord" } ] }